CVE-2026-115810: Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tandoor Recipesto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user with low privileges can exploit it. The attacker must be able to import a crafted Pestle JSON file containing a malicious image URL.
Are default deployments affected?
The issue is in the Pestle importer’s direct image-fetching request, which bypasses the application’s centralized SSRF protections. Deployments are affected if they run a version before 2.7.0 and permit a low-privileged authenticated user to use the Pestle importer.
What can an attacker access through the flaw?
The attacker can cause the server to make GET requests to arbitrary internal or external hosts. This can be used to reach internal-only endpoints, discover ports or services, and obtain internal responses through the stored recipe image.
What version resolves the issue?
Upgrade Tandoor Recipes to version 2.7.0 or later. The vulnerability affects versions before 2.7.0.